Underground · what matters today

Base de datos de clientes financieros de Taiwán a la venta

Taiwanese financial institutions (unspecified)

A seller claims to offer a 'Taiwanese financial customer database' dated 2026, presumably containing PII of customers from one or more financial institutions. The exact institution and record count are unconfirmed, but financial-sector data fuels fraud and account-takeover. Relevant if your monitoring overlaps Asian finance customers, though outside the primary AR-LATAM focus.

Base de datos del municipio de Caldera, Chile, a la venta

Municipio de Caldera, Chile

A seller is advertising a database belonging to the Municipality of Caldera in Chile's Atacama Region. Municipal data typically holds citizen PII, staff records and internal contacts useful for targeted phishing, invoice fraud and account takeover. A fresh public-sector leak in Latin America warrants immediate verification and notification to the entity.

Documento interno de la constelación Starshield de SpaceX filtrado

SpaceX (Starshield)

An internal SpaceX document describing the Starshield Constellation Technical Baseline and Architecture Description is circulating on a carding forum. Starshield is SpaceX's defense and military satellite line, so this leak can expose system architecture and security-relevant engineering detail valuable to adversaries. Aerospace and defense defenders should treat it as sensitive and assess linked personnel and credential exposure.

Filtración de base de datos de 100 GB de la operadora neerlandesa Odido

Odido (Netherlands telecom)

A 100GB dump claimed to be the complete Odido Netherlands database is being circulated for free under ShinyHunters branding on a leak forum. Odido is a major Dutch telecom, so exposed subscriber, billing and possibly network data would be critical-infrastructure grade. The post has no clear fresh date and may be a repost, so analysts should confirm whether it is new before alerting heavily.

Filtración de base de datos de 1 GB de gmao.gsfc.nasa.gov (NASA)

NASA Goddard GMAO (gmao.gsfc.nasa.gov)

A 1GB+ database from gmao.gsfc.nasa.gov, a NASA Goddard climate/assimilation modelling portal, has just been posted for download on DarkForums. Although it is a public-facing scientific subdomain, the dump may contain accounts, credentials, or internal records useful for follow-on access and social engineering. Federal aerospace research assets are high-value espionage targets, so defenders should verify the contents and check for reused credentials.

Oportunidad de acceso/phishing a gran empresa industrial internacional

A member advertised a 'potential for corporate phishing/access' against a major international industrial business on the spear.cx forum. No target is named and no actual credentials are shown, but such leads often precede targeted intrusion attempts. It is a vague access opportunity, so treat it as low-priority monitoring.

Base de datos de la calificadora india Infomerics a la venta

Infomerics (India)

A seller posted a database reportedly belonging to Infomerics, an Indian credit rating agency, on PwsForums. Credit-rating firms hold sensitive corporate financial and client data, making such dumps attractive for fraud and business-email-compromise. It concerns an Asian mid-size company, so relevance for AR/LATAM defenders is modest.

Filtración de datos del departamento francés de Aude

Departamento de Aude (Francia)

A free 'leaked download' claims data from Aude.fr, the departmental authority of Aude in southern France. The record count is not stated, but a regional government body leak could expose citizen or staff data. It is a European public-sector leak, relevant for awareness but outside the AR/LATAM priority.

Presunta filtración de la base de datos de osmose.numerique.gouv.fr

osmose.numerique.gouv.fr (Gobierno de Francia)

A PwsForums thread offers a free download of a database allegedly tied to osmose.numerique.gouv.fr, a French government environmental data platform. Scale and authenticity are unverified and such 'FREE' dumps are often recycled, but any exposure of a .gouv.fr system matters for public-sector defenders watching reused credentials and portal accounts. It sits outside the Argentina/LatAm priority scope, so treat it as context rather than a regional alert.

Oferta gratuita de acceso por phishing a una gran industria internacional

Major international industrial business (unnamed)

A forum user is freely giving away what is described as phishing/initial-access material against an unnamed 'major international industrial business'. No victim name, country or asset type (VPN, RDP, mailbox) is disclosed, so it cannot be tied to Argentine or LATAM critical infrastructure. It is only marginally useful as a lead if the actor later names the target.

Posible acceso corporativo filtrado de una gran empresa industrial internacional

Major international industrial business (unnamed)

A threat actor is distributing stealer-log data described as providing phishing and initial-access potential against a major international industrial company. The victim organization is not named, but exposed credentials could enable account takeover, lateral movement and follow-on intrusion. Industrial-sector defenders should treat this as a credential-exposure and access-risk warning and hunt for reused credentials.

Filtración de 500.000 registros de pedidos de trycircle.com (Kuwait)

trycircle.com

A leaked database from trycircle.com in Kuwait reportedly contains 500,000 order records. Order information typically includes names, contact details and purchase history, enabling phishing and fraud against customers. The volume makes it a meaningful commercial leak for regional defenders and fraud teams to monitor.

Base de datos de las Direcciones de Tránsito de Irak comprometida (500.000 registros)

Iraqi Traffic Directorates

A threat actor claims to have breached the Iraqi Traffic Directorates database, exposing roughly 500,000 records in 2026. Government registration data of this scale enables identity fraud, targeted phishing and abuse of license and vehicle records. Defenders in public-sector identity and transport systems should treat it as a confirmed exposure pending verification.

Venta de vulnerabilidades críticas en garuda-indonesia.com

Garuda Indonesia

A seller is offering critical vulnerabilities affecting garuda-indonesia.com, the site of Indonesia's state-owned flag carrier, posted minutes ago. Unpatched web flaws at a national airline can lead to customer-data exposure or deeper intrusion into booking and operational systems. Aviation targets warrant urgent patch verification and web attack-surface review.

Base de datos de un millón de clientes de Crypto.com a la venta

Crypto.com (CDC)

A seller is offering one million Crypto.com (CDC) customer "hits" dated October 2026. Credential and account datasets at this scale fuel account takeover, phishing and fraud against crypto users and carry regulatory weight. Exchange customers and fraud teams should prepare for credential-stuffing waves.

Base de datos de Komehyo Singapur (2M registros) a la venta

Komehyo Singapore

A seller lists a +2M-record database belonging to Komehyo's Singapore operations, a luxury resale/recommerce retailer. Exposed e-commerce customer data supports credential reuse, phishing and fraud against shoppers. Verification, password-reset enforcement and fraud monitoring are advisable.

Base de datos de Bajaj Auto con 860K registros a la venta

Bajaj Auto

A threat actor is selling a +860K-record database attributed to Bajaj Auto, a major Indian automotive manufacturer. Such customer/dealer data fuels phishing, account takeover and fraud, and can aid B2B targeting. Contextual monitoring and customer notification planning are warranted.

Base de datos de Vested Finance (11M registros) a la venta

Vested Finance

A seller is offering a +11M-record database belonging to Vested Finance, a US/India fintech platform. Customer PII and likely financial/account data at this scale enables credential stuffing, targeted phishing and account-takeover fraud against the firm's user base. Defenders should verify exposure, force resets and monitor for downstream fraud.

Filtración de datos personales de 200.000 húngaros de tiszavilag.hu

tiszavilag.hu (Tisza party network)

A seller on DarkNetArmy is offering roughly 200,000 records of Hungarian citizens allegedly tied to the tiszavilag.hu political platform, posted minutes ago by an unverified account. The data appears to be citizen PII linked to a political movement, which raises targeting, doxxing and influence-operation risks rather than enterprise compromise. It is fresh but outside the Argentina/LATAM scope and the seller is unverified, so treat as low priority.

Filtración de la base de datos de 25 millones de usuarios de BeMyEye

BeMyEye

A complete user database of crowdsourcing/mystery-shopping platform BeMyEye, roughly 25 million records, is being distributed for free on DarkNetArmy. The dump reportedly includes revenue and company funding data alongside user PII, which enables identity theft, credential stuffing and highly targeted phishing against corporate clients. Defenders whose employees or partners use the platform should treat it as compromised and monitor for reuse of those emails and phone numbers.

Datos de empresas multinacionales ofrecidos a la venta

A very recent DarkForums post advertises data from multiple multinational companies for sale, but names no specific victim or record count, making the claim unverifiable. If real, it could indicate a broker holding several corporate datasets. Treat as low-confidence until the seller provides samples tied to named organizations.

Base de datos de estudiantes de la universidad ITB de Indonesia a la venta

Institut Teknologi Bandung (ITB)

A fresh DarkForums listing offers a leaked student database belonging to ITB, a major Indonesian technical university. Education-sector PII such as names, IDs and contact details would be exposed if genuine. It is recent but outside the LATAM region, so relevant mainly as credential-reuse and supply-chain context.

Base de datos de clientes de Panera Bread circulando en foros

Panera Bread

A BreachForums thread from late July 2026 offers a Panera Bread database, a large US restaurant chain with tens of millions of loyalty customers. The post is roughly two and a half months old, so it is not a fresh alert, and the sample quality is unverified. Relevant only as background for credential-reuse monitoring against US retail accounts.

Filtración del diseño de ingeniería del plan de comidas de Indonesia

Dapur Makanan Bergizi Gratis (Indonesia)

A 2.5 GB archive of detailed engineering design documents for Indonesia's Dapur Makanan Bergizi Gratis (free nutritious meals) program was posted publicly. The leak exposes government infrastructure and planning data for a national initiative, aiding reconnaissance or disruption by adversaries. It is lower priority for AR-LATAM defenders but signals contractor and supply-chain exposure worth tracking.